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UNITED STATES 

FOREIGN INTELLIGENCE SURVEILLANCE COURT 
WASHINGTON, DC 



IN RE APPLICATION OF THE FEDERAL 
BUREAU OF INVESTIGATION FOR AN 
ORDER REQUIRING THE PRODUCTION 




Docket Number: BR 09-15 



SUPPLEMENTAL OPINION AND ORDER 

On October 30, 2009, the Court authorized the acquisition by the National Security 
Agency (“NS A”) of the tangible things sought in the government’s application in the above- 
captioned docket (“BR metadata”). This supplemental opinion and order reiterates the manner in 
which query results may be shared within the NSA, as informed by the testimony provided by 
government, and elaborates on the reporting requirement imposed in the Court’s order of 
October 30. 
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Sharing of BR Metadata Query Results Within the NSA 

The Court’s order permits NSA analysts who are authorized to query the BR metadata to 
share the results of authorized queries among themselves and with other NSA personnel, 
“provided that all NSA personnel receiving such query results in any form (except for 
information properly disseminated outside NSA) shall first receive appropriate and adequate 
training and guidance regarding the rules and restrictions governing the use, storage, and 
dissemination of such information.” Primary Order at 15, Docket No. BR 09-15 (October 30, 
2009) (“October 30 Order”). The order further provides: “[a] 11 persons authorized for access to 
the BR metadata and other NSA personnel who are authorized to receive query results shall 
receive appropriate and adequate training by NSA’s [Office of General Counsel] concerning the 
authorization granted by this Order, the limited circumstances in which the BR metadata may be 
accessed, and/or other procedures and restrictions regarding the retrieval, storage, and 
dissemination of the metadata.” Id- at 13. The Court’s prior order in this matter contained 
identical provisions. Primary Order at 12, 14-15, Docket No. BR 09-13 (September 3, 2009) 
(“September 3 Order”). 



In September, 2009, the Court received oral notification that NSA analysts had, on two 
occasions, shared the results of queries of the BR metadata with NSA analysts involved in the 
investigation who had not received “appropriate and adequate training and 
guidance” as required under the September 3 Order. Order Regarding Further Compliance 
Incidents at 2-3, Docket No. BR 09-13 (September 25, 2009). On September 25, 2009, the Court 
ordered representatives of the NSA and the National Security Division (“NSD”) of the 
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Department of Justice to appear for a hearing in order to inform the Court more fully of the scope 
and circumstances of the incidents, and to allow the Court to assess whether the Court’s order 
should be modified or rescinded and whether other remedial steps should be imposed. Id at 4. 

At the hearing, which was conducted on September 28, 2009, the government confirmed 
that NSA analysts authorized to query the BR metadata had sent query results to NSA personnel 
who had not received the training and guidance required by the Court’s September 3 Order. 
Transcript at 6-7, Docket No. BR 09-13. Specifically, the government reported that the NSA had 
created an e-mail distribution list (the NSA representative referred to this list as an “alias”) for 
the 1 89 NSA analysts who were working on the threat, only 53 of whom had 

received the required training and guidance. Id. at 6-7, 12-13. On September 17 , an NSA 
analyst authorized to query the BR metadata sent an e-mail to the alias that 

included a “general analytic summary” of the results of a query of the BR metadata. Id. at 7. 

After a recipient brought the e-mail to the attention of the NSA’s Oversight and Compliance 
Office and Office of General Counsel, the Oversight and Compliance Office issued guidance on 
September 21 st , “reemphasizing the point, no dissemination of query results in any form.” Id. at 
1 4. The NSA’s Counter-terrorism organization sent a similar reminder on the morning of 
September 22 nd , however, that afternoon, a second NSA analyst who was authorized to query the 
BR metadata sent a situation report to the alias that contained information 

derived from a query of the BR metadata. Id. at 15. 

The government testified at the hearing that the NSA has taken steps to ensure that any 
sharing of the results of queries of the BR metadata within the NSA is fully consistent with the 
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Court’s orders. First, the NS A has issued guidance interpreting “query results in any form,” to 
mean any information of any kind derived from the BR metadata. Id. at 16. Second, NSA aliases 
for sharing information that could include BR metadata query results, will be limited to NSA 
personnel who have received the necessary training and guidance to receive those query results. 
Id. at 21-22. The Court hereby affirms that the NSA may share BR metadata query results in this 
manner consistent with the Court’s October 30 Order. The only exception to this practice is 
under circumstances in which the Court has expressly authorized a deviation. 1 

Report on Queries Described in Footnote 6 of the Court’s October 30 Order 

According to the government, one advantage of the BR metadata repository is that it is 
historical in nature, reflecting contact activity from the past that cannot be captured in the present 
or prospectively. Declaration of 7, Docket No. BR 09-15. At the 

government’s request, the Court’s September 3 Order and October 30 Order both acknowledge 
that the government may query the BR metadata for historical purposes, using a telephone 
identifier that is not currently associated with one of the targeted foreign powers, but that was for 
a period of time in the past. 2 



1 For example, pursuant to paragraph (3)J of the Court’s order, NSA personnel authorized to query the BR metadata 
may use and share the identity of high-volume telephone identifiers and other types of identifiers not associated with 
specific users for purposes of metadata reduction and management, without regard to whether the recipient has 
received the training and guidance required for access to BR metadata query results. 



2 Both orders contain the following footnote: “The Court understands that from time to time the information 
available to designated approving officials will indicate that a telephone identifier was, but may not present! 



but was not formerh 



be. or 

associated wi th| ^ 

In such a circumstance, so long as the designated approving official can 
determine that the reasonable, articulable suspicion standard can be met for a particular period of time with respect 
to the telephone identifier, NSA may query the BR metadata using that telephone identifier. However, analysts 
conducting queries using such telephone identifiers must be made aware of the time period for (continued. . .) 
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Nevertheless, the NSA’s querying of the BR metadata using telephone identifiers that do 
not currently satisfy the “reasonable articulable suspicion” standard has been a source of concern 
for the Court. Given that telephone providers regularly re-assign telephone identifiers, and in 
light of the fact that the NSA acquires approximately call detail records per day, the 

vast majority of which are irrelevant to the Federal Bureau of Investigation’s (“FBI”) 
investigations and concern communications of United States persons in the United States, it 
would appear likely that such a query could produce results that include metadata from United 
States persons not under investigation by the FBI. In order to allay these concerns, the Court’s 
September 3 Order mandated that any application to renew or reinstate the authority granted 
therein must include a report describing, among other things, how the NSA has conducted [these 
types of queries] and minimized any information obtained or derived therefrom. September 
3 Order at 18. 



The government’s report submitted as Exhibit B to its Application in Docket Number 09- 
15, stated: 



From time to time, NSA may have information i ndicating that a particular 
identifier was used by an individual associated 

only for a 

particular timeframe. In these circumstances, NSA would seek and grant as 
appropriate, RAS approval, with the understanding that contact chaining would be 
conducted in a manner that covered a limited timeframe that has been identified. 



('...continued) which the telephone identifier has been associated 

I in order that the analysis and minimization of the 

information retrieved from their queries may be informed by that fact.” September 3 Order at 9, n. 5; October 30 
Order at 9, n. 6. 
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The report then provided one example of how the NSA had conducted such a query. NSA Report 
to the Foreign Intelligence Surveillance Court (BR 09-13) at 15-16. 

This report was not sufficiently detailed to allay the Court’s concerns, and the Court 
therefore continues to be concerned about the likelihood that these queries could reveal 
communications of United States person users of the telephone identifier who are not the subject 
of FBI investigations. As a result, the Court’s October 30 Order contains the same reporting 
requirements as the September 3 Order. October 30 Order at 18-19. However, to assist the 
government in providing a report that satisfies its needs, the Court HEREBY ORDERS that any 
report submitted by the government pursuant to paragraph (3)S of the Court’s October 30 Order 
shall include the following information with regard to how the NSA has conducted queries of the 
BR metadata using telephone identifiers determined to satisfy the reasonable articulable 
suspicion standard at some time in the past, but that do not currently meet the standard, and how 
the NSA minimized any information obtained or derived therefrom: 

1 . The total number of such queries run during the reporting period and what percentage 
those queries constitute of the total number of queries run. 

2. Would the status of a telephone identifier that was approved for querying under these 
circumstances be changed on the Station Table to non-RAS approved once a single query 
using that identifier has been run? If not, does the NSA have an automated process to 
limit queries of that telephone identifier to the specified time frame? If not, how will an 
NSA analyst know that any query of that telephone identifier must be limited to the time 
period for which the reasonable articulable suspicion existed? 
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3. Are NS A analysts permitted to conduct more than one query using any telephone 
identifier determined to have met the reasonable articulable suspicion standard under 
circumstances described above, and if so, for what purpose? If query results from the 
first query indicated that the telephone identifier’s association with the foreign power 
terminated earlier than the date the NSA believed the identifier no longer met the 
reasonable articulable suspicion, would the timeframe restriction be adjusted for any 
subsequent query? 

4. If this type of query is run, and the NSA analyst who ran the query determines that the 
query results include records of communications that were made after the telephone 
identifier was re-assigned to a United States person who is not associated with the foreign 
power, must the analyst delete or otherwise mask such records prior to sharing the query 
results with NSA analysts authorized to receive query results pursuant to paragraph (3)1 
of the Court’s order? 



ENTERED this 5th day of November, 2009. 




Judge, United States Foreign 
Intelligence Surveillance Court 
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